On Tue, 2008-05-27 at 12:10 -0400, Steve Grubb wrote:
...
 > Once we aggregate these would be tough to separate.
 
 That is why we added the node field. :)  You should probably enable it with 
 the name_format option. 
I think I do have it:
[root@hugo audit]# grep name_format /etc/audit/auditd.conf
name_format = hostname
LCB.
-- 
LC (Lenny) Bruzenak
lenny(a)magitekltd.com